Log in Start free

Vulnerability · Published Mar 5, 2020 · Assigned by mitre

CVE-2020-9402

High 8.8

In plain English

A high-severity security flaw in the py3-django package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.5% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)22.5%top 2.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-django1.11.29-r0ALPINE-CVE-2020-9402
Alpine:v3.21py3-django1.11.29-r0ALPINE-CVE-2020-9402
Alpine:v3.22py3-django1.11.29-r0ALPINE-CVE-2020-9402
Alpine:v3.23py3-django1.11.29-r0ALPINE-CVE-2020-9402
Alpine:v3.24py3-django1.11.29-r0ALPINE-CVE-2020-9402
Debian:12python-django2:2.2.11-1DEBIAN-CVE-2020-9402
Debian:13python-django2:2.2.11-1DEBIAN-CVE-2020-9402
Debian:14python-django2:2.2.11-1DEBIAN-CVE-2020-9402
PyPIdjango1.11.29, 2.2.11, 3.0.4PYSEC-2020-345
PyPIdjango1.11.29, 2.2.11, 3.0.4PYSEC-2020-36
PyPIdjango3.0.4GHSA-3gh2-xw74-jmcw
PyPIdjango2.2.11GHSA-3gh2-xw74-jmcw
PyPIdjango1.11.29GHSA-3gh2-xw74-jmcw

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References